Adversary-Based IOC Search for Faster Network Security Assessment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security assessment systems, such as SIEM, NDR, and EDR, are inefficient and imprecise in identifying specific adversaries and searching for Indicators of Compromise (IOCs), leading to potential harm and unnecessary resource drain, and lack integration with frameworks like MITRE ATT&CK for threat group tactics and techniques.
Innovation Solution
A method and system that identify adversaries based on detected behaviors, using SIEM systems like QRadar and knowledge bases like X-Force Exchange to search for specific IOCs associated with identified threat groups, leveraging the MITRE ATT&CK framework for tactics and techniques.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SIEM systems search across thousands of Indicators of Compromise (IOCs), then comprehensive security coverage is achieved, but system resource consumption increases and detection speed decreases
Solution Approach 1:
The patent segments the large set of thousands of IOCs into smaller, organized collections grouped by threat actor, campaign, or technique. This segmentation allows the system to search only relevant IOC subsets rather than all IOCs simultaneously, improving detection speed while maintaining comprehensive coverage through systematic organization of segmented data.
Solution Approach 2:
The system performs partial searches by selecting and searching only the most relevant IOC collections based on detected adversarial behavior patterns, rather than exhaustively searching all available IOCs. This partial action approach achieves sufficient security coverage for identified threats while significantly reducing resource consumption and improving detection speed.
2Reliability
If SIEM systems search across thousands of Indicators of Compromise (IOCs), then comprehensive security coverage is achieved, but unnecessary resource drain occurs
Solution Approach 1:
By segmenting IOCs into organized collections, the system avoids processing all IOCs uniformly. Only relevant collections are loaded and searched based on detected adversarial patterns, reducing memory usage and computational resources while maintaining comprehensive coverage of identified threats.
Solution Approach 2:
The system extracts and focuses only on the necessary IOC subsets relevant to detected adversarial behavior, separating these from the larger IOC database. This extraction approach minimizes resource consumption by processing only essential data while maintaining security coverage for identified threats.
3Measurement precision
If comprehensive IOC searches are performed, then all potential indicators are detected, but detection time increases causing delayed response
Solution Approach 1:
The system performs preliminary organization of IOCs into pre-segmented collections during system setup or idle periods. When adversarial behavior is detected, the relevant IOC collections are already prepared and ready for immediate searching, eliminating the need for time-consuming ad-hoc organization during active detection and reducing overall detection time while maintaining completeness.
Data Source
AI summary
A computer-implemented method comprises establishing a database based at least in part on network traffic data received from a network, detecting adversarial behavior within the network traffic data, identifying an adversary associated with the adversarial behavior, determining a plurality of specific indicators of compromise that are associated with the adversary that has been identified, constructing a query based on the plurality of specific indicators of compromise, submitting the query to search for the plurality of specific indicators of compromise within the network traffic data, searching for the plurality of specific indicators of compromise within the network traffic data, and generating, responsive to having located at least one potential indicator of compromise, a search report containing at least one specific indicator of compromise and displaying the search report to a user interface.